IDS Forum

Odd situation - SETUID fail

Posted By: cesar_inacio_martins@yahoo.com.br
Date: Friday, 3 April 2009, at 1:02 p.m.

Hi,

This is a very specific and odd situation, I already discover the
workaround (odd too), but I like to try understand the real origin of
the problem, if anybody have a explanation, I appreciate..

In small talk , the problem are with SETUID effect ( or not effect in this case).

For me , appear be a Bug on OpenSuse (kernel or glibc).

I install OpenSuse 11.1 on my new notebook and update the packages and patches,

| cmartins@note-cim:~> uname -a

| Linux note-cim 2.6.27.7-9-pae #1 SMP 2008-12-04 18:10:04 +0100 i686 i686 i386 GNU/Linux

| cmartins@note-cim:~> rpm -q glibc

| glibc-2.9-2.11.1

After that I install IDS 11.5 UC3 Developer Edition and try to initialize it with very basic configuration.

When I execute the "oninit -iv" with user "informix" I got this (pay attention to ">" ):

| informix@note-cim:~> oninit -ivy

| Checking group membership to determine server run mode...succeeded

| Reading configuration file '/opt/IBM/ids1150uc3de/etc/onconfig.idsmoon'...succeeded

>| Creating /INFORMIXTMP/.infxdirs...FAILED

| Creating infos file "/opt/IBM/ids1150uc3de/etc/.infos.idsmoon"...succeeded

| Linking conf file "/opt/IBM/ids1150uc3de/etc/.conf.idsmoon"...succeeded

| Checking config parameters...succeeded

| Writing to infos file...succeeded

| Allocating and attaching to shared memory...succeeded

| Creating resident pool 10570 kbytes...succeeded

| Allocating 100016 kbytes for buffer pool of 2K page size...succeeded

| Initializing rhead structure...succeeded

| Initialization of Encryption...succeeded
| tail: cannot open `$INFORMIXDIR/log/online.log' for reading: No such file or directory
| touch: cannot touch `/INFORMIXTMP/.idsmoon.alarm': No such file or directory

>| awk: cmd. line:1: fatal: cannot open file `/INFORMIXTMP/.idsmoon.alarm' for reading (No such file or directory)

>| mv: cannot move `/tmp/.idsmoon.alarm_9782' to `/INFORMIXTMP/.idsmoon.alarm': No such file or directory

>| SENDER IS NULL NO MAIL WILL BE SENT

>| /opt/IBM/ids1150uc3de/etc/alarmprogram.sh[517]: /INFORMIXTMP/.idsmoon.alarm: cannot create [No such file or directory]

| WARNING: server initialization failed, or possibly timed out (if -w was used).

| Check the message log, online.log, for errors.

Here is the log

| informix@note-cim:/opt/IBM/ids1150uc3de/log> cat online.log

| 17:33:43 IBM Informix Dynamic Server Started.

| 17:33:43 Warning: The IBM IDS Developer Edition license restriction limits

| 17:33:43 the total shared memory size for this server to 1048576 KB.

| 17:33:43 The size has been reset to the limit to bring up the database server.

>| 17:33:44 Could not disable priority aging: errno = 13

| Wed Apr 1 17:33:44 2009

>| 17:33:44 Error: Unable to reset open files limit, must run as super-user

| 17:33:44 Event alarms enabled. ALARMPROG = '/opt/IBM/ids1150uc3de/etc/alarmprogram.sh'

>| 17:33:44 Assert Failed: net_init.c, line 321, thread 1, errno=13, error in creating /INFORMIXTMP.

| 17:33:44 IBM Informix Dynamic Server Version 11.50.UC3DE

| 17:33:44 Who: Session(0, @, 0, (nil))

| Thread(1, main_thread, 0, 1)

| File: neterrb.c Line: 658

| 17:33:44 stack trace for pid 9819 written to /opt/IBM/ids1150uc3de/tmp/af.3e9cfa8

| 17:33:44 See Also: /opt/IBM/ids1150uc3de/tmp/af.3e9cfa8, shmem.3e9cfa8.0

| 17:33:47 neterrb.c, line 658, thread 1, proc id 9819, net_init.c,
line 321, thread 1, errno=13, error in creating /INFORMIXTMP..

| 17:33:47 PANIC: Attempting to bring system down

Searching for errno 13 in the /usr/include/asm-generic/errno-base.h

| #define EACCES 13 /* Permission denied */

So, for me this appear be a problem with SETUID on binaries , but, when I look them , are all ok!

| informix@note-cim:/opt/IBM/ids1150uc3de/log> ls -l $INFORMIXDIR/bin/on*

| -rwsr-sr-x 1 root informix 1064326 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/onaudit

| -rwxr-xr-x 1 informix informix 3916 2008-10-28 03:21 /opt/IBM/ids1150uc3de/bin/onbar

| -rwsr-sr-x 1 root informix 2322330 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onbar_d

| -rwxr-sr-x 1 informix informix 1718092 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/oncheck

| -rwxr-xr-x 1 informix informix 1633911 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/oncmsm

| -rwsr-sr-x 1 root informix 2216014 2008-10-28 03:21 /opt/IBM/ids1150uc3de/bin/ondblog

| -rwsr-sr-x 1 root informix 1206868 2008-10-28 03:21 /opt/IBM/ids1150uc3de/bin/onedcu

| -rwxr-sr-x 1 informix informix 593771 2008-10-28 03:21 /opt/IBM/ids1150uc3de/bin/onedpu

| -rwsr-sr-- 1 root informix 15854167 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/oninit

| -rwxr-sr-x 1 informix informix 1012653 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onload

| -rwxr-sr-x 1 informix informix 1551144 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/onlog

| -rwsr-sr-x 1 root informix 1180325 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onmode

| -rwxr-sr-x 1 informix informix 2418013 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/onmonitor

| -rwxr-sr-x 1 informix informix 1376237 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onparams

| -rwxr-xr-x 1 informix informix 619278 2008-10-21 08:59 /opt/IBM/ids1150uc3de/bin/onpassword

| -rwxr-xr-x 1 informix informix 1806361 2008-10-28 03:21 /opt/IBM/ids1150uc3de/bin/onperf

| -rwxr-xr-x 1 informix informix 1700699 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/onpladm

| -rwxr-sr-x 1 informix informix 2461805 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onpload

| -rwsr-sr-x 1 root informix 596092 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/onshowaudit

| -rwsr-sr-x 1 root informix 2382077 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onsmsync

| -rwsr-s--- 1 root informix 2129434 2009-03-30 16:05 /opt/IBM/ids1150uc3de/bin/onsnmp

| -rwxr-sr-x 1 informix informix 1373427 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onspaces

| -rwsr-s--- 1 root informix 585659 2008-10-28 03:21 /opt/IBM/ids1150uc3de/bin/onsrvapd

| -rwxr-sr-x 1 informix informix 3882028 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onstat

| -rwsr-sr-x 1 root informix 1955921 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/ontape

| -rwxr-sr-x 1 informix informix 1012657 2009-03-30 16:04 /opt/IBM/ids1150uc3de/bin/onunload

If I try initialize with "root" the /INFORMIXTMP is created , but others problems appears:

| 17:39:29 IBM Informix Dynamic Server Version 11.50.UC3DE Software Serial Number AAA#B000000

| 17:39:29 The chunk '/ifmxdados/L_rootdbs.ch1' must have owner-ID "informix" and group-ID "root".

Insisting to use with "root" , after change the group-id of the chunk , apparently all appears works fine and the instance are initialized, when
I try to use onstat with "informix" user, this occur:

| informix@note-cim:~> onstat -

| onstat: Shared memory: permission denied.

|

| root@note-cim:~# ipcs -mc

| ------ Shared Memory Segment Creators/Owners --------

| shmid perms cuid cgid uid gid

>| 1343488 660 root root root root

>| 1376257 660 root root root root

So, to resolve the situation I wrote the C code below , and finally , this way use the IDS on my note:

|

| cmartins@note-cim:~/fontes/c> cat myexec.c

| #include <stdio.h>

| #include <unistd.h>

| #include <stdlib.h>

|

| int main(int argc, char *argv[] ) {

| if ( argc != 4 ) {

| printf("\nInvalid Parameters!\nsyntax: [uid] [gid] [command]\n\n");

| exit(1) ;

| }

| int i;

| printf("argc = %i\n", argc );

| for (i = 0 ; i <= argc-1 ; i++) printf("\targ %i = %s\n", i, argv[i]);

|

| printf( "\nSetting Effective UID = %s GID = %s\n", argv[1], argv[2]);
| setregid(atoi(argv[2]),atoi(argv[2])); // define real/effective groups

| //setreuid(0,atoi(argv[2])); // define effective user

| printf("Effective / Real UID/GID defined:\n");

| printf("uid=%i \t gid=%i \t euid=%i \t egid=%i \n\n", getuid(), getgid(), geteuid(), getegid());

|

| printf("Executing %s\n", argv[3] );

| system(argv[3]);

| }

|

| cmartins@note-cim:~/fontes/c> gcc myexec.c -o myexec

| cmartins@note-cim:~/fontes/c> exit

| logout

|

| root@note-cim:~# cp /home/cmartins/fontes/c/myexec /usr/local/bin

| `/home/cmartins/fontes/c/myexec' -> `/usr/local/bin/myexec'

| root@note-cim:~# chmod ug+s,o+rx /usr/local/bin/myexec

| root@note-cim:~# ls -l /usr/local/bin/myexec

| -rwsr-sr-x 1 root root 11099 2009-04-03 10:34 /usr/local/bin/myexec

|

| root@note-cim:~# . env.idsmoon

| root@note-cim:~# id informix

| uid=1001(informix) gid=1000(informix) groups=16(dialout),33(video),1000(informix)

| root@note-cim:~# myexec 1001 1000 "oninit -iyv"

| argc = 4

| arg 0 = myexec

| arg 1 = 1001

| arg 2 = 1000

| arg 3 = oninit -iyv

|

| Setting Effective UID = 1001 GID = 1000

| Effective / Real UID/GID defined:

| uid=0 gid=1000 euid=0 egid=1000

|

| Executing oninit -iyv

| ...

| informix@note-cim:~# ps -fC oninit

| UID PID PPID C STIME TTY TIME CMD

>| informix 5025 1 0 10:14 ? 00:00:12 oninit -iyv

| root 5026 5025 0 10:14 ? 00:00:00 oninit -iyv

| root 5027 5026 0 10:14 ? 00:00:00 oninit -iyv

| root 5028 5026 0 10:14 ? 00:00:00 oninit -iyv

| root 5029 5026 0 10:14 ? 00:00:00 oninit -iyv

| root 5031 5026 0 10:14 ? 00:00:00 oninit -iyv

| root 5032 5026 0 10:14 ? 00:00:00 oninit -iyv

| root 5033 5026 0 10:14 ? 00:00:00 oninit -iyv

| informix@note-cim:~# ipcs -mc

|

| ------ Shared Memory Segment Creators/Owners --------

| shmid perms cuid cgid uid gid

>| 1605632 660 root informix root informix

>| 1638401 660 root informix root informix

|

| informix@note-cim:~> onstat -

|

| IBM Informix Dynamic Server Version 11.50.UC3DE -- On-Line -- Up 00:33:36 -- 144144 Kbytes

And to shutdown the instance I need to use the "myexec" otherwise if I
try shut with "informix" user the shared memory is not released.

So, anyone have a explanation for this???

Cesar

Veja quais são os assuntos do momento no Yahoo! +Buscados
http://br.maisbuscados.yahoo.com

IDS Forum is maintained by Administrator with WebBBS 5.12.